Eggdrop: Buffer overflow — GLSA 200709-07

A remote stack-based buffer overflow has been discovered in Eggdrop.

Affected packages

Background

Eggdrop is an IRC bot extensible with C or Tcl.

Description

Bow Sineath discovered a boundary error in the file mod/server.mod/servrmsg.c when processing overly long private messages sent by an IRC server.

Impact

A remote attacker could entice an Eggdrop user to connect the bot to a malicious server, possibly resulting in the execution of arbitrary code on the host running Eggdrop.

Workaround

There is no known workaround at this time.

Resolution

 # emerge --sync
 # emerge --ask --oneshot --verbose ">=net-irc/eggdrop-1.6.18-r3"

References

• CVE-2007-2807

Release date
September 15, 2007

Latest revision
September 26, 2007: 02

Severity
normal

Exploitable
remote

Bugzilla entries

• 179354